summaryrefslogtreecommitdiffstats
path: root/system/libraries/Security.php
diff options
context:
space:
mode:
authorDerek Allard <derek.allard@ellislab.com>2010-07-22 20:10:26 +0200
committerDerek Allard <derek.allard@ellislab.com>2010-07-22 20:10:26 +0200
commit958543a38c2c97b0ec4c10fc9faf4f0753143880 (patch)
tree3fe57f162c835afc278b537fd2e5932828c55e6c /system/libraries/Security.php
parent924000e27e10eb32cff6b7666a9d41546fd5f2bd (diff)
Adding CSRF into config
Adding CSRF token into form open()
Diffstat (limited to 'system/libraries/Security.php')
-rw-r--r--system/libraries/Security.php16
1 files changed, 11 insertions, 5 deletions
diff --git a/system/libraries/Security.php b/system/libraries/Security.php
index cdae50168..c8d435046 100644
--- a/system/libraries/Security.php
+++ b/system/libraries/Security.php
@@ -54,7 +54,7 @@ class CI_Security {
{
// Set the CSRF hash
$this->_csrf_set_hash();
-
+
log_message('debug', "Security Class Initialized");
}
@@ -67,21 +67,24 @@ class CI_Security {
* @return null
*/
function csrf_verify()
- {
+ {
// If no POST data exists we will set the CSRF cookie
if (count($_POST) == 0)
{
return $this->csrf_set_cookie();
}
+ // Append application specific cookie prefix to token name
+ $csrf_token_name = (config_item('cookie_prefix')) ? config_item('cookie_prefix').$this->csrf_token_name : $this->csrf_token_name;
+
// Do the tokens exist in both the _POST and _COOKIE arrays?
- if ( ! isset($_POST[$this->csrf_token_name]) OR ! isset($_COOKIE[$this->csrf_token_name]))
+ if ( ! isset($_POST[$this->csrf_token_name]) OR ! isset($_COOKIE[$csrf_token_name]))
{
$this->csrf_show_error();
}
// Do the tokens match?
- if ($_POST[$this->csrf_token_name] != $_COOKIE[$this->csrf_token_name])
+ if ($_POST[$this->csrf_token_name] != $_COOKIE[$csrf_token_name])
{
$this->csrf_show_error();
}
@@ -134,7 +137,10 @@ class CI_Security {
$this->csrf_hash = md5(uniqid(rand(), TRUE));
}
}
-
+
+ // Create the cookie before we finish up
+ $this->csrf_set_cookie();
+
return $this->csrf_hash;
}